CVE-2026-55077
Coder allows organizations to provision remote development environments via Terraform.
Impact
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password` endpoint authorized only `ActionUpdatePersonal` and did not prevent a `user-admin` from resetting an `owner` account's password. It also did not require the current password when an admin reset another user's password. Exploitation requires the privileged `user-admin` role so practical risk is limited to deployments that grant `user-admin` to less trusted operators. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 prevents non-owner users from resetting the password of an account that holds the `owner` role. As a workaround, restrict the `user-admin` role to trusted administrators.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/coder/coder/v2 | >= 2.34.0, < 2.34.2 | 2.34.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Coder | Coder | before 2.29.17 from 2.30.0 before 2.32.7 from 2.33.0 before 2.33.8 from 2.34.0 before 2.34.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-29xf-69gq-m9jx
- https://github.com/coder/coder/security/advisories/GHSA-29xf-69gq-m9jx
- https://github.com/coder/coder/pull/25709
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2